Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Backup Exec 2010 R3 SP2 - Completely Empty Selection List

Created: 25 Sep 2012 | 27 comments

Environment:

os: 2k8R2 (STIG'd image) x64

Backup Exec 2010 R3 SP2 x64

Hotfixes: 180429, 176937, 191248, 194471

New Selection List -> Selections -> View by Resource:  All Resources = NO DATA

 

Recently followed TECH67768 (to a 't') to standdown a 2k3 and x32 BE 2010 R3 SP2 and bring it up as the above (Server with the SAME name).  Currently there are issues with the installation and weird issues. 

When I go into the selection list it is empty, by right-clicking on All Resources and choosing "Manage Active Directory Domains" causes BE to close and the following (see screen shot) error to happen.  I have called Symantec Support and put in a ticket but haven't had an engineer call me back yet and this is a big issue since the server has been down for a while now (almost a week) and we really need backups the whole xcopy thing is getting old...

 

Followed by "External Component has thrown an exception"

 

--Thanks in advance for any help

 

-fyi- I have already looked at the following and no help :(

http://www.symantec.com/business/support/index?page=content&id=TECH136078

http://www.symantec.com/business/support/index?page=content&id=TECH124919

http://www.symantec.com/business/support/index?page=content&id=TECH139808

Comments 27 CommentsJump to latest comment

sunshine4x's picture

Just got a new error from attempting to Manage Active Directory at All Resources within the Selection list:

sunshine4x's picture

FYI - just tested manually adding a newly build server to a selection list by \\<SERVER>\C:\*.*/SUBDIR and was able to get backup to tape and backup to disk successfully.

Here's a shot of the selection list:

 

sunshine4x's picture

Trying this: https://www-secure.symantec.com/connect/forums/selection-list-empty

 

lol, for irony... - In an attempt to see where my case progress was since I opened a case this morning here is what symantec web services is showing:

 

"MySupport Application Error

The MySupport application has encountered a program error. You can either try again or contact  Symantec Technical Services

Thank you for your patience."

 

 

 

 

 

CraigV's picture

Hi sunshine,

 

Have you tried the following:

1. Run a repair of BE through Add/Remove Programs?

2. Run a repair of the BEDB through BEutility.exe?

3. Tried to create a new selection list and see if this error is repeated? If not, then you might have to recreate your selection lists as there is probably some sort of corruption.

Thanks!

Alternative ways to access Backup Exec Technical Support:

https://www-secure.symantec.com/connect/blogs/alte...

sunshine4x's picture

Hey guys, thanks for the posts! 

CraigV:

1. Run a repair of BE through Add/Remove Programs? - Not yet, that's next

2. Run a repair of the BEDB through BEutility.exe? - Yes and it was went fine :/ 

3. Tried to create a new selection list and see if this error is repeated? If not, then you might have to recreate your selection lists as there is probably some sort of corruption. - This error follows all of the previous and new selection list attempts

pkh:

One of the reasons why your selection list is empty could be that the BESA has insufficient privileges.  Check this using this document.- I have ensured that there are the correct permissions by creating an GPO with those settings and enforced it on the OU where my servers reside.  I've also followed the following post to no avail: http://www.symantec.com/connect/forums/selection-list-empty

 

I've created a new service account (modeled after the BE practices of membership/permissions) and added it to the GPO as well and associated all of the services with it, default logon etc, no go.

One thing that I did find that I was wondering if it may be an issue is that the default local administrator was listed in the BE application with the OLD password from before the server was rebuilt.  I'm wondering what other items may have the old system default administrator account associated to it with the old password.  I haven't seen any other things obvious.  I did reset the credentials within BE to the current credentials and rebooted to test.  As a test I am going to set the default admin account password back to the original, pre-imaged password and see if that resolves anything.  I will update. 

Any other thoughts?  McAfee is installed on the server.  I can uninstall that and attempt again - I just find it odd that it would be able to successfully push out agents and successfully back data up if McAfee was being a problem child.

 

sunshine4x's picture

Another update: (for those chasing this problem in the future :) )

Tried the following, didn't resolve my problem:

1. At Start > Run, type DCOMCNFG, and press Enter.

2. Expand Component Services and then Computers.

3. Right click on My Computer, and choose Properties.

4. "Default COM Security" tab (For Windows 2003).

5. Click on the "Edit Default" button in the "Access Permissions" section.

6. Add in the account that is specified for the Backup Exec services, along with the System account, and give them "Allow Access" rights

7. Click OK, and then OK to close the application.

8. Start the Backup Exec services with the user account
 

sunshine4x's picture

Does anyone know what system service BE may utilize to populate the resources within the selection list?   SSDP, etc?  Since this is a STIG'd image there may be a system service (non-backup exec) that is disabled but is needed for this process.

Jaydeep S's picture

In Backup Exec go to Network -> Logon Accounts and look up the System Logon Account. Make sure that this has a valid set of credentials incuding the current password. Also confirm that the account has not got locked up in AD. Set this account to default and then try to create a new selection.

Also have you confirmed if all the Backup Exec Services are started? Make sure that the Backup Exec Remote Agent Service has been started in a 'Local System Account'. If not change this and restart all Backup Exec Services.

sunshine4x's picture

JayDeep-

Currently logged in with the default service account setup for BE (which is declared with the permissions needed via Symantec in GPO, local administrator group, etc).

Services:

Backup Exec Error Recording Service - Started -Local System

Backup Exec Server - Started - Domain SA

Backup Exec Management Service - Not Started - set to automatic - Domain SA

Backup Exec Job Engine - Started - Domain SA

Backup Exec Device and Media Service - Started - Domain SA

Backup Exec Agent Browser - Started - Domain SA

Backup Exec Remote Agent for Windows Systems - Started - Local System

 

Domain SA is set with the following permissions via GPO:

 -Act as part of the operating system
 -Backup files and directories
 -Create a Token Object
 -Logon as a service
 -Manage auditing and security log
 -Restore files and directories

Account is member of the following:

Domain Admins

Backup Operators

Local Administrators

Jaydeep S's picture

Thank you for the information sunshine4x. Is this Default service account also the System Logon Account. If there is any error here, the selection list will not load.

 

sunshine4x's picture

Got it :)  You can also change that to be a service account as well.  Either way (setting the default local system account or domain sa) it doesn't work.  I also noticed that, when running procmon, the application is accessing a file under ProgramData\Symantec\CRF and when opening up that Log file I see that it states multiple times (as though in a loop)

"09/26/2012 07:25:00 AM [1]:  CRFServer version 1.0.130.0
09/26/2012 07:25:00 AM [1]:  Initializing Report Engine.
09/26/2012 07:25:00 AM [3]:  Initializing reporting engine.
Logging Level:  Basic
09/26/2012 07:25:12 AM [9]:  Rendering report in format:  HTML
09/26/2012 07:25:19 AM [9]:  Length cannot be less than zero.
Parameter name: length
09/26/2012 07:34:50 AM [7]:  Shutting Down Report Engine.
09/26/2012 07:34:51 AM [3]:  Shutting down.  Exiting control loop."

Upon looking at a working system I see that it states only:

"09/26/2012 07:25:00 AM [1]:  CRFServer version 1.0.130.0
09/26/2012 07:25:00 AM [1]:  Initializing Report Engine
Logging Level:  Basic
09/26/2012 07:25:12 AM [9]:  Rendering report in format:  HTML

Jaydeep S's picture

Could you please start SGMon.exe (Backup Exec install folder) select 'RAWS, Job Engine, Agent Browser' and 'Capture to File' and then attempt to make a new selection. Would help if you can post that log saved in Backup Exec\Logs folder as Servername-SGMon.log

sunshine4x's picture

I think my database is hosed.  Even though a repair through beutility was successful and and showed no issues I am seeing PDDE (Pure de-duplication engine) start issues in the ADAMM file and attempting to run the SGMON utility (debugging utility) I get some of the following (didn't want to post the huge file but here's the beginning of it):

 

*****************************************************************************

*****                    SGMon log for \\\\SERVER                    *****

*****                    Local Offset =04:00                            *****

*****************************************************************************

BENGINE:  [09/26/12 11:23:03] [2236]     [server]             - DeviceManager: timeout event fired

BENGINE:  [09/26/12 11:23:03] [2236]     [server]             - DeviceManager: processing pending requests

BENGINE:  [09/26/12 11:23:03] [2236]     [server]             - DeviceManager: going to sleep for 900000 msecs

BENETNS:  [09/26/12 11:25:05] [2424]     Beginning agent database grooming.

BENETNS:  [09/26/12 11:25:05] [2424]     Agent database grooming complete.

BKUPEXEC: [09/26/12 11:26:33] [0000]     BECRYPTO Base Address is BE00000

BKUPEXEC: [09/26/12 11:26:33] [0000]     BECRYPTO is not loaded at proper base address, halting FIPS initialization!

BKUPEXEC: [09/26/12 11:26:33] [0000]     BECryptoInit: Initialized locks for SSL callbacks

BKUPEXEC: [09/26/12 11:26:33] [0000]     BECryptoInit: BECrypto non-FIPS mode successfully enabled.

BKUPEXEC: [09/26/12 11:26:33] [3244]     "Cluster" key does not appear to be present in the registry

BKUPEXEC: [09/26/12 11:26:33] [3244]     Failed to open Microsoft cluster ()

BKUPEXEC: [09/26/12 11:26:33] [3244]     VCS cluster keys do not appear to be present in the registry

BKUPEXEC: [09/26/12 11:26:33] [3244]     Failed to open VCS cluster ()

BESERVER: [09/26/12 11:26:34] [3744]     -1 Client requested key (1348673370).

BESERVER: [09/26/12 11:26:34] [3744]     "Cluster" key does not appear to be present in the registry

BESERVER: [09/26/12 11:26:34] [3744]     Failed to open Microsoft cluster ()

BESERVER: [09/26/12 11:26:34] [3744]     VCS cluster keys do not appear to be present in the registry

BESERVER: [09/26/12 11:26:34] [3744]     Failed to open VCS cluster ()

Jaydeep S's picture

Are you using Deduplication option or CAS - MMS setup. If yes, I would not recomend you to make changes to the bedb as such. If beutility was successful then it looks like it might be something else. We need to first check if there are any erros in the debug.

sunshine4x's picture

JayDeep, do you know if the following from sgmon is an issue?

"BKUPEXEC: [09/26/12 11:26:33] [0000]     BECRYPTO Base Address is BE00000

BKUPEXEC: [09/26/12 11:26:33] [0000]     BECRYPTO is not loaded at proper base address, halting FIPS initialization!"

 

BTW - I am also seeing this error (as I listed above) but have SQL 2K5 not SQL 2K8.

http://www.symantec.com/business/support/index?pag...

 

I have been on the phone with support and am being transfered for the issue, here are the things I was asked to do:

I was asked to follow: http://www.symantec.com/business/support/index?pag...

I was also asked to turn off UAC - Neither helped resolve my issue.

 

 

 

Jaydeep S's picture

Following those errors do you have "BECryptoInit: BECrypto non-FIPS mode successfully enabled" anywhere. If this is then it might be that FIPS mode was not getting initialized. However, that should not stopping the selection list from getting populated.

CraigV's picture

...have you tried to run bemig.exe to migrate your BEDB again?

Alternative ways to access Backup Exec Technical Support:

https://www-secure.symantec.com/connect/blogs/alte...

sunshine4x's picture

CraigV - no, I haven't but I will try that.

 

By the way, a repair didn't resolve the issue either.

lmosla's picture

Hello Sunshine,

Try uninstalling your remote agent via Programs and Features.  You will probably need to reboot the server afterwards,

Then follow http://www.symantec.com/business/support/index?page=content&id=TECH91735#Manual_Install to install the Remote Agent again.  After this is installed open up the Remote Agent Utility and verify under the Publishing tab the Media server's name is listed.  You can also add the IP address of the media server here.

Next go back to the Backup Exec server GUI, restart the services and then try to view the selection list again.

Thanks

sunshine4x's picture

Thanks for the comment, Lmossla - however there is no backupexec remote agent on the backup server and I'm not sure I see how uninstalling and reinstalling the remote agent on other servers would address that backup server doesn't even list itself as a resource within the selection list. 

 

CraigV - BEMIG didn't yield any results.  I've installed SQL Management Studio 2005 Express and can query the resource table, however, and get values from the database itself so that's at least something.

CraigV's picture

sunshine: are you in any sort of position to remove BE completely and then reinstall from scratch?

EDIT: You can also try the TN below to see if this works:

http://www.symantec.com/business/support/index?page=content&id=TECH67296

The TN you did use though should have worked. I've used that numerous times...

Alternative ways to access Backup Exec Technical Support:

https://www-secure.symantec.com/connect/blogs/alte...

lmosla's picture

No,  uninstalling and reinstalling the remote agent on other servers certainly wouldnt be applicable. :)

Have you gone into Tools > Backup Exec Services then click on Service Account Credentials and in the Service Account Information check the Change service account credentials to reenter the service logon account credential information?    You would want to check the checkbox for Change startup options and set it to Automatic and check the checkbox for Grant required rights to the service account. The services should restart.

sunshine4x's picture

Even though I didn't believe it to be an issue I uninstalled all of the agents and reinstalled them.  No change.  This isn't an issue of missing my "favorite" resources (which can is an issue that can be resolved by uninstalling the agents and reinstalling them).  Please see the screen shot of the selection list - it is COMPLETELY empty.

This issue is usually caused by incorrect permissions.  That is not the cause here. 

When attempting to right-click on All Resources and manage every AD or user-defined selection lists the errors referenced above are thrown.  When running procmon I can see that it is accessing the database and grabbing the selection list properties values.  When it passes it back to the application .NET v2 (not looking at it at the moment so I'm not sure of the full version) then makes a call and the application crashes.  My thoughts are that whatever BE uses to populate that section of the GUI is corrupted.  Not sure how to resolve that though.

I did uninstall and reinstall .net 3.5 but that obviously didn't do anything.

Jaydeep S's picture

Sunshine4x is there any firewall installed. If yes could you please disable it and check. Also please add the name and ipaddress entires for the media server in the hosts file like this -

ipaddress          netbios 

ipaddress          fqdn

Restart the BE services and then check.

Also is this a snadalone BE install. Are you using Deduplication.

NKS's picture

Sunshine, in one of your comments above, I could see that you mentioned the Domain account is added to below policies.

 -Act as part of the operating system
 -Backup files and directories
 -Create a Token Object
 -Logon as a service
 -Manage auditing and security log
 -Restore files and directories.
 
Did you miss to say Logon as a Batch Job? or, if its true that you did not add the user account to that policy, the solution would be adding the Logon account to that Policy, as your Media server is a Windows 2008 family.
 
Also make sure backup account or any group on which he is a member is not added in the Deny Logon as a Batch Job policy.
 
Once you added,kindly open secpol.msc from the server and verify that you can see the account is showing up in the Logon as a batch job.
 
Configure the account which you added in the policy, as the defaul Logon account in BE and run gpupdate/force from start- Run and then check your selection list. It will show all the resources.